[Freeipa-users] ACI for ipa-getkeytab
James James
jreg2k at gmail.com
Tue Sep 9 21:17:31 UTC 2014
SOLVED.
realm-proxy has to be indirect member of :
memberofindirect: cn=manage host
keytab,cn=privileges,cn=pbac,dc=example,dc=com
Thanks for your help.
2014-09-09 16:59 GMT+02:00 Rob Crittenden <rcritten at redhat.com>:
> James James wrote:
> > My user : realm-proxy is in a group (Smart Proxy Host Management) which
> > has the Manager host keytab permission :
> >
> > Permission name: Manage host keytab
> > Permissions: write
> > Attributes: krbprincipalkey, krblastpwdchange
> > Type: host
> > Granted to Privilege: Host Administrators, Host Enrollment, Smart
> > Proxy Host Management
> >
> >
> > When I try to retreive a keytab from another host when my principal is
> > the realm-proxy :
> >
> >
> > [root at client1 ~]# kinit realm-proxy at EXAMPLE.COM
> > <mailto:realm-proxy at EXAMPLE.COM> -k -t /tmp/freeipa.keytab
> >
> > [root at client1 ~]# klist
> >
> > Ticket cache: KEYRING:persistent:0:0
> > Default principal: realm-proxy at EXAMPLE.COM <mailto:
> realm-proxy at EXAMPLE.COM>
> >
> > Valid starting Expires Service principal
> > 09/09/2014 14:35:50 09/10/2014 14:35:50 krbtgt/EXAMPLE.COM at EXAMPLE.COM
> > <mailto:EXAMPLE.COM at EXAMPLE.COM>
> >
> > [root at client1 ~]# ipa-getkeytab --server=ipa.example.com
> > <http://ipa.example.com> --principal=host/client1.example.com
> > <http://client1.example.com> --keytab=/etc/krb5.keytab
> > Operation failed! Insufficient access rights
> >
> >
> > I can't retrieve the key ..
>
> I'd need to see the smart-proxy user, show --all --raw would be best.
>
> I just tested this on a RHEL-6 instance I had handy and it worked fine:
>
> # ipa user-add --first=test --last=user tuser1 --password
> # ipa role-add 'host keytab' --desc 'manage host keytabs'
> # ipa privilege-add 'manage host keytab' --desc 'manage host keytabs'
> # ipa privilege-add-permission 'manage host keytab'
> --permissions='manage host keytab'
> # ipa role-add-privilege 'host keytab' --privileges='manage host keytab'
> # ipa role-add-member --users=tuser1 'host keytab'
> # kinit tuser1
> # ipa-getkeytab -s `hostname` -k /tmp/test.keytab -p host/test.example.com
> Keytab successfully retrieved and stored in: /tmp/test.keytab
>
> rob
>
> >
> > 2014-09-09 16:14 GMT+02:00 Rob Crittenden <rcritten at redhat.com
> > <mailto:rcritten at redhat.com>>:
> >
> > James James wrote:
> > > My IPA version is 3.0.0 .
> > > Thanks
> >
> > The permission 'Manage host keytab' should do the trick.
> >
> > rob
> >
> > >
> > > 2014-09-09 1:22 GMT+02:00 Dmitri Pal <dpal at redhat.com <mailto:
> dpal at redhat.com>
> > > <mailto:dpal at redhat.com <mailto:dpal at redhat.com>>>:
> > >
> > > On 09/08/2014 06:52 PM, James James wrote:
> > >> Hi everybody,
> > >>
> > >> I want a user to be able to do ipa-getkeytab to retrieve the
> keys
> > >> from any host in the realm.
> > >>
> > >> How can I do this ?
> > >>
> > >> Where I can find an ACI example
> > >>
> > (
> https://www.redhat.com/archives/freeipa-users/2010-July/msg00024.html)
> > >> which can helps me ?
> > >>
> > >>
> > >> Thanks for your help.
> > >>
> > >>
> > >>
> > >>
> > > Which version of IPA?
> > > There reason for the question is because in FreeIPA 4.0 the
> ACIs
> > > were significantly reworked.
> > >
> > > --
> > > Thank you,
> > > Dmitri Pal
> > >
> > > Sr. Engineering Manager IdM portfolio
> > > Red Hat, Inc.
> > >
> > >
> > > --
> > > Manage your subscription for the Freeipa-users mailing list:
> > > https://www.redhat.com/mailman/listinfo/freeipa-users
> > > Go To http://freeipa.org for more info on the project
> > >
> > >
> > >
> > >
> >
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20140909/005e90ac/attachment.htm>
More information about the Freeipa-users
mailing list